GO-2026-6293 vulnerabilities

Vulnerabilities for packages: temporal-fips, falcosidekick-ui, kube-metrics-adapter, listmonk, temporal, falcosidekick-ui-fips, kube-metrics-adapter-fips, temporal-ui-server, temporal-ui-server-fips...

GHSA-VFP3-V2GW-7WFQ vulnerabilities

Vulnerabilities for packages: temporal-fips, falcosidekick-ui, kube-metrics-adapter, listmonk, temporal, falcosidekick-ui-fips, kube-metrics-adapter-fips, temporal-ui-server, temporal-ui-server-fips...

GHSA-VFP3-V2GW-7WFQ vulnerabilities

Vulnerabilities for packages: temporal-ui-server, kube-metrics-adapter, temporal...

CVE-2026-75601

Static Web Server SWS is a production-ready web server suitable for static web files or assets. Through 2.43.0, instances with both basic-auth and metrics features enabled process the /metrics endpoint before the basic-auth check in src/handler.rs, allowing an unauthenticated remote attacker to...

CVE-2026-75601 Static Web Server: Authentication bypass on /metrics endpoint when --basic-auth is enabled

Static Web Server SWS is a production-ready web server suitable for static web files or assets. Through 2.43.0, instances with both basic-auth and metrics features enabled process the /metrics endpoint before the basic-auth check in src/handler.rs, allowing an unauthenticated remote attacker to...

CVE-2026-75601

Static Web Server (SWS) versions through 2.43.0 contain an authentication bypass when both the basic-auth and metrics features are enabled. The /metrics endpoint is processed before the basic-auth check in src/handler.rs, allowing an unauthenticated remote attacker to retrieve Prometheus metrics ...

CVE-2026-75601 Static Web Server: Authentication bypass on /metrics endpoint when --basic-auth is enabled

Static Web Server SWS is a production-ready web server suitable for static web files or assets. Through 2.43.0, instances with both basic-auth and metrics features enabled process the /metrics endpoint before the basic-auth check in src/handler.rs, allowing an unauthenticated remote attacker to...

CVE-2026-55677 vulnerabilities

Vulnerabilities for packages: temporal-fips, falcosidekick-ui, kube-metrics-adapter, listmonk, temporal, falcosidekick-ui-fips, kube-metrics-adapter-fips, temporal-ui-server, temporal-ui-server-fips...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: metrics (UTSA-2026-093182)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093182 advisory. Apache Log4j2 2.0-beta9 through 2.15.0 excluding security releases 2.12.2, 2.12.3, and 2.3.1 JNDI features used in configuration, log messages, and parameters do not...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: metrics (UTSA-2026-093185)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093185 advisory. Apache Log4j2 versions 2.0-alpha1 through 2.16.0 excluding 2.12.3 and 2.3.1 did not protect from uncontrolled recursion from self-referential lookups. This allows an...

CVE-2026-79668

Ech0 before 4.7.3 contains an authentication bypass vulnerability in the PUT /api/echo/like/:id endpoint that allows unauthenticated attackers to increment engagement metrics without identity verification or rate limiting. Attackers can send repeated requests to arbitrarily inflate the favcount...

BIT-KEYCLOAK-2026-16100 Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error text

A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages can include user-supplied input like nonexistent client IDs, an authenticated...

EUVD-2026-65446

Ech0 before 4.7.3 contains an authentication bypass vulnerability in the PUT /api/echo/like/:id endpoint that allows unauthenticated attackers to increment engagement metrics without identity verification or rate limiting. Attackers can send repeated requests to arbitrarily inflate the favcount...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: batman-adv: The unmanaged ELP worker is removed. The ELP worker needs to calculate new metric values for all “reachable” neighbors via an interface. Some of the metric calculation functions require locks, which may need to be...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: tcpmetrics: validate source addr length I don’t see any checks to ensure that TCPMETRICSATTRSADDRIPV4 is at least 4 bytes long. Also, the policy does not have any entries for this attribute at all similarly, there are no entries...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/i915: fixed a race condition UAF in i915perfaddconfigioctl. Userspace may attempt to race the creation of the oaconfig object with config remove, resulting in a use-after-free if we dereference the object after unlocking the...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ipv4: Prevent potential spectre v1 exploits in fibmetricsMatch if !type continue; if type RTAXMAX return false; ... fival = fi-fibmetrics-metricstype - 1; Since @type is used as an array index, we need to prevent CPU speculation ...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ipv4: Prevent potential spectre v1 gadgets in ipmetricsconvert if !type continue; if type RTAXMAX return -EINVAL; ... metricstype - 1 = val; @type is used as an array index, and we need to prevent CPU speculation or risk leaking...

Oracle WebLogic Server - Remote Command Execution

The Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: Web Services allows unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server. Versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. id: CVE-2019-2725 info: name: Oracle WebLogic...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: cluster-api-ipam-provider-in-cluster, spicedb-operator, metrics-server, spicedb, tekton-chains, node-feature-discovery, rancher-agent, k3s, kube-metrics-adapter, kube-rbac-proxy, cass-operator, rancher, openbao, yunikorn-k8shim, kubernetes-csi-external-resizer,...